This is probably legit: WIKILEAKS GUY 
TRYING TO GET THROUGH. I FINALLY 
FIGURED OUT WHAT IS GOING ON 


There has been a guy messaging me saying "the blockchain is compromised". I assumed 
Bitcoin, but now I know it is Julian assanges dead man switch blockchain, for the 
huge releases he said he'd do if anything happened. This would obviously confirm 
he's in trouble because he is not here to correct the breaches. Here are a few of the 
messages sent: 


"Here are the tools to get Assange's information out of the blockchain. We are about to get 
gagged. Or worse. Pis do the right thing. These tools won't be around for long. FULL 
DISCLOSURE, let the people have the truth. No matter how damming. Sir, this 
information is dangerous. They killed Jean, and group one is missing. We need this public 
asap. We need more people involved. Be safe, sir. Thank you for being a true patriot. The 
tools will be improved if we can. https://github.com/WikiLeaksFreedomForce. And here is 
the bot link to the archived conversation as we built this. You will need the conversation to 
understand what to do. https://blargbot.xyz/logs/#3cvppr this is time sensitive. Thank you." 

"I hope that if you have the resources available, you have people looking into the 
blockchain. The massive ddos was 10/21. We have found things, and others have 
reported finding full files and keys. We are working on discord in the open. Members of my 
team have gotten gag orders, and I'm sure my time is coming soon. Pis don't let this be for 
nothing" 

Also. We are unsure of if the blockchain was altered on Oct 27 2016. We have been using 
a local for our tests. U can find it on the darkweb. These tools... They are not perfected, 
but if u get your people on them. It will be more then enough to get you to the files. We still 
haven't combined the torrent magnets. And transmission of enclosed data seems to get 
people vanned. There has been multiple attempts to make this public for the past two 
months. Now, we have so many people doing this, I don't know if it can be stopped without 
shutting down the internet. This is what alot of people died for Jim. We're giving it to u first. 
And we will continue to share it with anyone interested. These kid fucking old guard types 
need to meet justice. And Julian deserves a legacy after this. The fact that his dms 

triggered indicates terrible things. My name is A K s. I live in Canada. I'm not the 

one who made this, I only helped. I'm not a spook. Nor a terrorist. Just a person who has 
had enough of the bullshit" 

"Here are the tools to get Assange's information out of the blockchain. We are about to get 
gagged. Or worse. Pis do the right thing. These tools won't be around for long. FULL 
DISCLOSURE, let the people have the truth. No matter how damming. Sir, this 
information is dangerous. They killed Jean, and group one is missing. We need this public 
asap. We need more people involved. Be safe, sir. Thank you for being a true patriot. The 
tools will be improved if we can. https://github.com/WikiLeaksFreedomForce. And here is 





the bot link to the archived conversation as we built this. You will need the conversation to 
understand what to do. https://blargbot.xyz/logs/#3cvppr this is time sensitive. Thank you." 


http://82.221.129.208/baasepageh2.html 
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SALTS: 

insurance. aes256 DE 18 IB 73 EF F3 5E 39 DA 
wlinsurance-20130815-A.aes256 OF 0B DA 00 F0 35 9A OF C8 
wlinsurance-201 3081 5-B.aes256 AB C2 04 75 6B AB 85 BE 30 
wlinsurance-201 3081 5-C.aes256 73 6B 46 4C 2F 84 9A C2 A4 

INSURANCE SNIPPETS: 

http://qateway.qlop.me/ipfs/QmUUiWf1 KLshZBQWHDt8yVaabHdMiJA2q1 md7YS8qsvMci/insurance.aes256.5120 
http://qatewav.qlop.me/ipfs/QmZHmQrNuBL1 MJEi3cSn7bYoLShLiqGue5oeqZmcvHtBD6/wlinsurance-20130815-A.aes256.5120 
http://qatewav.qlop.me/ipfs/QmRRAnoHqZGqMrJodHA3Ni6GeQ5i4y1AHUbG8MqVXWshMH/wlinsurance-20130815-B.aes256.5120 
http://qatewav.qlop.me/ipfs/QmPCPmGwvCqhvMrVENUB1AEbzkZ9dULE9rBJcVMqc5RG1 M/wlinsurance-20130815-C.aes256.5120 
http://qateway.qlop.me/ipfs/QmNdwpvqWXkYsxPnioL8rSZZpVDRDNu3YYvddsQ7dLdrEC/2016-06-03 insurance. aes256. 51 20 
http://qatewav.qlop.me/ipfs/QmcDMXxr99Fi583oZKYqFzq8TwomuqeV49oFkMrtGHEJ6Z/2016-1 1-07 WL-lnsurance EC.aes256.5120 
http://qateway.qlop.me/ipfs/QmPAoxkRcJERJEvi3uXsnKwe819WkqnX2Gp1 VqpoaxLtvs/201 6-1 1-07 WL-lnsurance UK.aes256.5120 
http://qatewav.qlop.me/ipfs/QmaYUUco1 VtVurovbrtboMvu6kvFp9pdz6CEA97ftxoiv5/201 6-1 1 -07 WL-lnsurance US.aes256.51 20 

FILES: 

https://file.wikileaks.org/torrent/2016-1 1-07 WL-lnsurance US.aes256.torrent 
https://file.wikileaks.org/torrent/2016-1 1-07 WL-lnsurance UK.aes256.torrent 
https://file.wikileaks.org/torrent/2016-1 1-07 WL-lnsurance UK.aes256.torrent 
https://file.wikileaks.org/torrent/2016-06-03 insurance. aes256.torrent 
https://file.wikileaks.org/torrent/wikileaks-insurance-20120222.tar.bz2.aes.torrent 
https://file.wikileaks.org/torrent/wlinsurance-20130815-A.aes256.torrent 
https://file.wikileaks.org/torrent/wlinsurance-20130815-B.aes256.torrent 
https://file.wikileaks.orq/torrent/wlinsurance-20130815-C.aes256.torrent 

https://web.archive.org/web/20100901 162556/https ://leakmirror.wikileaks.orq/file/straw-glass-and-bottle/insurance.aes256 

US Kerry [1]- 4bb96075acadc3d80b5ac872874c3037a386f4f595fe99e687439aabd0219809 
UK FCO [2]- f33a6de5c627e3270ed3e02f62cd0c857467a780cf6123d2172d80d02a072f74 
EC [3]- eae5c9b064ed649ba468f0800abf8b56ae5cfe355b93b1 ce90a1 b92a48a9ab72 

sha256sum 2016-1 1 -07_WL-lnsurance_US.aes256 ab786b76a1 95cacde2d94506ca51 2ee950340f 1 40424431 27781 44f67d4c8002 
sha256sum 2016-1 1 -07_WL-lnsurance_UK.aes256 655821 2531 35f8eabff54ec62c7f243a27d1 d0b7037dc21 0f59267c43279a340 
sha256sum 2016-1 1 -07_WL-lnsurance_EC.aes256 b231 Ccef70338a857e48984f0fd73ea920eff70ab6b593548b0adcbd1 423b995 

wlinsurance-201 3081 5-A.aes256 [5], [6] 

6688fffa9b39320e1 1 b941 f0004a3a76d49c7fb52434dab4d7d881 dc2a2d7e02 
wlinsurance-201 3081 5-B.aes256 [5], [7] 

3dcf2dda8fb24559935919fab9e5d7906c3b28476ffa0c5bb9c1d30fcb56e7a4 



wlinsurance-20130815-C.aes256 [5], [8] 

91 3a6ff8eca2b20d9d2aab5941 86346b6089c0fb9db1 2f6441 3643a8acadcfe3 

insurance. aes256 [9], [10] 
cce54d3a8af37021 3d23fcbfe8cddc861 9a0734c 

[1] https://twitter.com/wikileaks/status/787777344740163584 

[2] https://twitter.com/wikileaks/status/787781 04651969331 6 

[3] https://twitter.com/wikileaks/status/787781 51 9951 720449 

[4] https ://twitter.com/wikileaks/status/796085225394536448?lang=en 

[5] https://wiki.installqentoo.com/index.php/Wiki Backups 

[6] https://file.wikileaks.org/torrent/wlinsurance-20130815-A.aes256.torrent 

[7] https://file.wikileaks.org/torrent/wlinsurance-20130815-B.aes256.torrent 

[8] https://file.wikileaks.oro/torrent/wlinsurance-20130815-C.aes256.torrent 

[9] https://wikileaks.org/wiki/Afqhan War Diary, 2004-2010 

[10] https://web.archive.org/web/20100901 162556/https ://leakmirror.wikileaks.orq/file/straw-qlass-and-bottle/insurance.aes256 
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THREADS: 

oniichanylo2tsi4.onion/thread-5b30554cf29073d3aee1 a74c298234c8e36a7bad.html 

https://oxwuqzccvk3dk6ti.onion.to/tech/res/679042.html 

https://s6424n4x4bsmqs27.onion.to/pol/res/20366.html 

https://web.archive.Org/web/20161030073742/http://8ch.net/pol/res/7946506.html 
https://web.archive.org/web/2016102321 1637/https ://oxwuqzccvk3dk6ti.onion.to/pol/res/7931 897.html 
https://web.archive.Org/web/20161024220236/http://8ch.net/pol/res/7962287.html 
https://oxwuqzccvk3dk6ti.onion.to/pol/res/8180723.html 
https://oxwuqzccvk3dk6ti.onion.to/tech/res/679042.html 

DECODING ONE TX: 

Download http://qatewav.qlop.me/ipfs/QmSU67Ei3TerNe32CcZTqd48iKqsVvBTqera1qBWFiKK9V/iean.py 
(or http://qatewav.olop.me/ipfs/QmburFHeUtM3wdrEi3rmUuBkx6iDmYprevGCvHiiqJhZnh/iean b.py) 

Usage: 

python jean.py transaction_number 
Example: 

python jean.py 691dd277dc0e90a462a3d652a1 171686de49cf19067cd33c7df0392833fb986a 
Returns: 

"Wikileaks Cablegate Backup 
cablegate-201 01204181 1 .7z 

Download the following transactions with Satoshi Nakamoto's download tool which can be found in transaction 

6c53cd9871 19ef797d5adccd76241247988a0a5ef783572a9972e7371c5fb0cc Free speech and free enterprise! Thank you Satoshi!" 

DECODING FILES: 

A nice example is the original Bitcoin paper. It can be found in transaction 



54e48e5f5c656b26c3bca1 4a8c95aa583d07ebe84dde3b7dd4a78f4e41 86e71 3. 

python jean.py 54e48e5f5c656b26c3bca14a8c95aa583d07ebe84dde3b7dd4a78f4e4186e713 > paper.pdf 
Once it is done you will be able to see a pdf was generated in that directory. 

Note that the transaction that generates the Bitcoin paper is related to the transaction that describes the Wikileaks cable dump, the 
cable dump itself, and many other transactions that have other content. Some has yet to be completely decrypted. These transactions 
are all related because they have common addresses involved or the money resulting from the transaction was used. 

For example, take a look at this 

transaction: https://blockchain.info/tx/08654f9dc9d673b3527b48ad06ab1b199ad47b61fd54033af30c2ee975c588bd 
If you do 

python jean.py 08654f9dc9d673b3527b48ad06ab1 bl 99ad47b61 fd54033af30c2ee975c588bd 
You will get a key that was leaked. 

Now, if you look at the addresses involved, you can see one at the bottom, below Wikileaks. It does not show 'Escrow'. Go to that 
address and see its transactions. You will then find another message. Keep doing this and you’ll eventually find the cable dump again. 
This is the process of 'following the change'. 

Using this method we've found several transactions that involve Wikileaks that we don't quite understand. One good strategy is to 
generate a file from a transaction and then look at its 'magic numbers' to figure out what it could be. 

Some of them are: 

7379ab5047b143c0b6cfe5d8d79ad240b4b4f8cced55aa26f86d1d3d370c0d4c 
d3c1 cb2cdbf07c25e3c5f51 3de5ee36081 a7c590e621 f 1 fl eab62e8d4b50b635 
Cce82f3bde0537f82a55f3b8458cb50d632977f85c81dad3e1983a3348638f5c 
2a14783f74796ace53e0a6859a7012723d3d6cd9dacf72d4e90a3394484093df 
657aecafe66d729d2e2f6f325fcc4acb850 1 d8f025 1 2d 1 f5042a36dd 1 bbd21 dl 
05e6c80d9d6469e7d1 328e89b9d971 bl 9972594701 586bbcbd70070f2be799db 
623463a2a8a949e0590ffe6b2fd3e4e1028b2b99c747e82e899da4485eb0b6be 
51 43cf232576ae53e8991 ca389334563f 1 4ea7a7c507a3e081 fbef2538c84f6e 
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>1 might be compremised. Se, before I get silenced, I'd like to present some tips for those investigating the blockchain angle (in the 
case that I am unable to continue my work): 

>1 . Sort transactions based on TX Fees. The DMS TX(s) will probably have a high fee associated with it to a) ensure its inclusion in the 
block (against the spamming attacks we're seeing) and b) draw attention to it. If a transaction contains an OP_RETURN and has an 
unusually high fee, IT IS WORTH INVESTIGATING. 

>2. Look for duplicate OP_RETURN data. Provided there wasn't a lone machine setup to post the DMS, it would likely be posted twice 
or more. Create a script to store transactions in a database. Store block number, date, op_return, fee and amount (if any of the outputs 
contain "911", also pay attention.) 

>3. The DMS will likely NOT come from the Wikileaks address (but might go to it). In the event that the server(s) hosting the DMS got 
compromised, the attacker would have access to that address' private key (and thus all of WikiLeaks' funds). 



>4. This address might be worth investigating: htt 

ps://blockchain. info/address/1 NquFI c4AuKx9YJtP9SsjGqhazfa72yPBM?offset=1 00&filter=0 

Many OP_RETURNs and all on the 10/16/2016 within a period of a few hours. I have not had the chance to investigate further. 

>Some side notes: Bootstrap8080.bitmessage.org and Bootstrap8444.bitmessage.org were down last night around 3AM (USA time). 
Worth checking DNS history on these to ensure they weren't compromised. 

>My computer is sending ICMP packets routinely to addresses in San Francisco and UK. This is one of my reasons to suspect 
compromise (could these be packing non-erronous data?). 
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>Stop relying on scripts and crappy software. The steps to find every single file in the blockchain have been posted here numerous 
times >>22945 . A lot of you have been staring at the data for over a week now. Flere’s another attempt at being even more clear: 

>Every single file has a hex file header. You can see a list of some here: http://www.qarykessler.net/library/file siqs.html and 
here http://file-extension.net/seeker/seeker.cqi?ext=&filetvpe AND=pqp&filetvpe OR=&filetvpe NOT=&seek=Seek%21 However, this 
is not the entire list. The lists 'trid' and 'file' use are not complete either. Yet, you don't even need these lists. You can simply look at any 
file of a type you are interested in finding. Yes, any. Open it with a hex editor and look at the file header. If you want to find a zip file, just 
download any zipfile, look at the header with a hex editor and then search for it. The headers are not going to always be at the 
beginning of the file. Scan the entire file for headers and footers. 

>Yes footers. Files also have footers! You can find the ending of a file by looking for its hex footer. Here are some 

examples: http://www.datadoctor.biz/data recovery programming book chapter14-paoe2.html Again, this is not a complete list. If you 

want to see what the footer of a file looks like, open one with a hex editor. 


Anonymous 1 2/07/201 6 (Wed) 1 9:37:08 [Preview] No. 19 [XI del 
(454.10 KB 750x382 90375bb35550eb7e1 2a2e660703881 23-imaqeipeq.ipq] 



For publishers for example, so that, as an example we are starting to use Bitcoin, Wikileaks, stuffing our, cryptographic keys of stuff that 
we publish, so, we prove that we have published stuff at a particular time by stuffing it in Bitcoin, in the blockchain, and then, if someone 
were to come and try to modify the material that we have published, to take a particular part, that would be detectable'. -Julian 
Assange, Nantucket Project, Sept 28 2104 





Wikileaks needs to change in order to survive and thrive through the next few months... If necessary of course, if I'm not able to 
continue or the Ecuadorian people are unreasonably blamed for Wikileaks' publications, I will have to resign as editor, but our 
publications will continue. The part of the necessary defense of Wikileaks, we have engaged in a new project to recruit people across 

the world to defend our publication - and we'll give details of that as the weeks go by we will issue guidelines about how you can 

promote Wikileaks publications without censorship. - Julian Assange, Wikileaks 10 Years Press Conference, Oct 4th 2016 
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https://en.rn. wikipedia.org/wiki/Rubberhose %28file svstem%29 

>The project was originally named Rubberhose, as it was designed to be resistant to attacks by people willing to use torture on those 
who knew the encryption keys. This is a reference to the rubber-hose cryptanalysis euphemism. 

>lt was written in 1 997-2000 by Julian Assange, Suelette Dreyfus, and Ralf Weinmann.[ 
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http://gatewav.glop.me/ipfs/QmSYg1TfsV7vKW3hzQRv9gxMSDUgztka5vVu91S9sFVeuM/code-fixed.7z 
To compile: 

gcc bcrdr2.c sha256.c ripe160.c -Isqlite3 -o bcrdr2 
To Run: 

./bcrdr2 cblocks dir> <database file> 
e.g: 

./bcrdr2 -/.bitcoin/blocks/ out.db 
WHAT IT DOES: 




This program reads through every file named blk*.dat in the folder to point it at and parses it. 
It creates an sqlite3 database with the following schema: 

CREATE TABLE BLOCK(" 

"ID INT PRIMARY KEY NOT NULL," 

"PREV CHAR(64) NOT NULL," 

"MERKLE CHAR(64) NOT NULL," 

"HASH CHAR(64) NOT NULL," 

"NUM INT ," 

"BITS INT NOT NULL," 

"NONCE INT NOT NULL," 

"TIME INT NOT NULL);"; 

Block header info, including the computed double SHA256 hash for the block. 

PREV is previous block hash, MERKLE is the merkle root hash, HASH is this block's hash. 
The other fields are miscellaneous. 

"CREATE TABLE TX(" 

"ID INT PRIMARY KEY NOT NULL,” 

"HASH CHAR(64) NOT NULL," 

"FILE TEXT NOT NULL," 

"OFFSET INT NOT NULL);"; 

Transaction header. 

HASH is this transaction's SHA double hash. 

FILE is the .DAT file's ID that it came from (See the FILE table below to get the file's name) 
OFFSET is the offset in the file it came from. 
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HOW TO GET THE KEYS (AND MORE) FROM THE BLOCKCHAIN: 

The goal is to make very simple code that is easy to use and understand so that everyone can do this. This is a rough explanation of 
how it works. 

There are two main approaches users are taking to decode messages in the blockchain. Scanning transactions, let’s call this 'tx 




scanning', and scanning blocks, let’s call this ’block scanning’. The main reason users are not yet able to see meaningful content is 
because both approaches have to be combined. 

TX SCANNING: 

When you scan by transactions, you look for a transaction number (tx id), and decode its contents. When you know the tx id, you can 
easily see which wallets were involved. Some messages require you to combine the decoded data from multiple tx ids. You can identify 
which tx ids are relevant by looking at transaction histories of the wallets involved. This strategy is used for the ’Cablegate Backup’. In 
that case, the list of tx ids is directly told to the readers in the first message. However, you can compile this list on your own by ’tx 
crawling’. To do this, follow these steps: 

. For each tx, look at the wallets that received money and find those that spend it (in this case it is only one per tx). 

. For that wallet, look at its transaction history and find a transaction that follows a similar pattern, i.e., it involves multiple wallets and 
only one spends the funds. 

. Continue doing this until you are not able to see the pattern repeat itself. 

BLOCK SCANNING: 

When you scan by block, you will be able to find encoded data more easily but it is harder to extract the tx id and wallets. One benefit of 
block scanning is that you can explicitly search for file headers and important strings. For example you can directly search for the magic 
numbers in GPG files. When you find one of these, you can then tx crawl from that starting point in order to get all pieces of the file. 
More concretely, if you want to find the Cablegate Backup with a block scanner, you could search for the magic number of Zip files. 
Then, when one is found, you can find the tx id that contains it, and finally tx crawl to get all the pieces. Yet, file headers are just one of 
the many other patterns that can be used to find important transactions. Examples of others are: 

. Magic numbers: Look for the first bytes in different types of file, ’file’ can be used in UNIX. 

. Ability to compress: Compress the decoded output. If the size is reduced, the output is possibly a message or part of a file. 

. Text: If the decoded output has text, it might have information. 

. Keywords (Very important): Search for relevant keywords, e.g., checksums for files in Wikileaks.org, checksums for the insurance 
files, hashes, dates, names, time stamps, etc. 

. Reversibility: Some messages are in reverse and need to be flipped. This should be tried both before and after decoding. 
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Both scanners have to be used. The starting points for the searches should be Wikileak's wallet, important dates (for example, during 
the DDoS attacks), previous messages and checksum hashes. The Cablegate Backup was a bit simpler than the more recent 
messages. In that case, only one wallet spent the funds in each transaction, and simply looking at wallet's next transaction was enough 
to find all the pieces. Newer messages are bit more complicated. Some of the wallets that receive money make multiple transactions 
with no encoded data before proceeding with the 'real' transaction. Moreover, in a lot of cases, all wallets involved spend the funds (not 
just one). Therefore, the crawler has to keep track of all wallets that receive funds, and all future transactions of that wallet while using 
techniques (like those above) to detect encoded data. A transaction tree should be kept and the pieces of each files should be 
combined in multiple orderings. 

If you implement the process described above you will find all the keys, other backups and other files that are not released. One way to 
test your code is to search for checksum hashes for files that have already been published at a specific date. There are multiple 
messages in the blockchain that include file hashes and dates. [/spoilerjUse the leads in this thread. [/spoiler] 

I recommend you use a local copy of the blockchain and carry out the search on a computer that has no internet access. Work in 
groups and share the process. Remember to look at other cryptocurrencies as well and to encode your findings into the blockchain 
yourself. 

Good luck! 
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FAST POSTING: 

Download Gajim https://qaiim.org/ (or any Jabber client that supports OTR and a proxy 
option https://wikipedia.org/wiki/List of XMPP client software) 

Download OTR plugin https://dev.qaiim.org/qaiim/qaiim-pluqins/wikis/OffTheRecordPluqin https://dev.qaiim.org/qaiim/qaiim- 
pluains/tree/master/qotr (Or the plugin needed for your Jabber client) 

Create a GPG key (if using GPG for encryption and not OTR) 

Make account: 

Server: volatile. ch 
Advanced: 

Hostname: vola7ileiax4ueow. onion Port: 5222 

Make a new proxy option with manage to: 127.0.0.1 9050 (socks5) 

Preferences (for volatile account): 

Disable 'Allow client / OS information to be sent' 

Disable 'Allow local system time information to be sent' 

Disable 'Log encrypted chat session' 

Disable 'Allow my idle time to be sent' 

Edit > Accounts > General (for volatile account): 

Disable 'Synchronize accounts status with global status' 

Disable 'Save conversation logs for all contacts' 


Anonymous 1 2/07/201 6 (Wed) 21 :27:50 [Previewl No. 25 [XI del 
join chat room "ebin" on muc. volatile. ch 


Anonymous 1 2/07/201 6 (Wed) 22:20:1 5 [Previewl No. 26 [XI del 
This is the new bunker. Old endchan thread compromised 


Anonymous 1 2/08/201 6 (Thu) 1 8:35:1 8 [Previewl No. 27 [XI del 
BLOCK 435250 

Link Anomaly Status Amount Size Time 

https://blockchain.info/tx/64abaf5ffac37f41c5a1b8b52deb5a21 C7400b2a4e1f20433bb3120c6c36ae51 Unable to decode output address 
Unspent 0 288 201 6-1 0-21 13:16:09 

https://blockchain.info/tx/3410d6264a83683ce785289eebd17f7ccb14b7b2abcee34ece534cf1b75087c9 Unable to decode output 
address Unspent 0 269 2016-10-21 13:16:09 



https://blockchain.info/tx/26a78bfda83f5f6b6bae3957ca1 aca31 51 943661 7902ea74220233b868b2a805 Unable to decode output 
address Unspent 0 256 2016-10-21 13:16:09 

https://blockchain.info/tx/6e41 2ca61 1 2f0f0f1 4680d831 51 033ba1 8035eb4b81 387f 1 f9ce38df3c6893af Unable to decode output address 
Unspent 0 242 201 6-1 0-21 13:16:09 

https://blockchain.info/tx/5fbfe2dbc0965cc1 d74ecc06a1 e4a776d4303a40c8f71 61 68ab6ad01 a87794ea Unable to decode output 
address Unspent 0 242 2016-10-21 13:16:09 

https://blockchain.info/tx/a9dbcd57268b4b6d7eb40e09c5b5970f2c4d897bd3d47f83be658bfbc45580f1 Unable to decode output 
address Unspent 0 275 2016-10-21 13:16:09 

https://blockchain.info/tx/1 7202c7ae9efec4dae73db1 45ea61 del fae090fd57d667f31 8871 de45d799bc1 Unable to decode output 
address Unspent 0 275 2016-10-21 13:16:09 

https://blockchain.info/tx/0fb02f09d71 0737cdd4c0d47c50774a7a1 1 ae548b972f071 965935955a1 31 5b4 Unable to decode output 
address Unspent 0 648 2016-10-21 13:16:09 

https://blockchain.info/tx/944de0e90a70ca656400f37d4b5de761 9dd0874ad9a8c1 709f500c5431 0ba2e7 Unable to decode output 
address Unspent 0 264 2016-10-21 13:16:09 

https://blockchain.info/tx/0c8e715db1a79a8020e8f292c08f20749dfb8b59e5048884f82c22ac3293a9a6 Unable to decode output 
address Unspent 0 265 2016-10-21 13:16:09 

https://blockchain.info/tx/11d40e3c6e1 1de924be7ec71af2d76cbdddd7a6359a6ea672787aca4ce25c5fb Unable to decode output 
address Unspent 0 237 2016-10-21 13:16:09 

https://blockchain.info/tx/2cd710205c0249eea43d0e589a6beabc9a9d488fc0c9c8e2497b48dfbf9e091 1 Unable to decode output 
address Unspent 0 237 2016-10-21 13:16:09 

https://blockchain.info/tx/82e7daf1 9b24d4f3228d1 4a88add9f7b401 951 d821 81 ed532f739cf3c1 fa2022 Unable to decode output address 
Unspent 0 237 201 6-1 0-21 13:16:09 

https://blockchain.info/tx/aa23347580cc98b47bd662ae418de250141f22b8649dcb79630e56bfc80ea445 Unable to decode output 
address Unspent 0 238 2016-10-21 13:16:09 

https://blockchain.info/tx/d295f447d25a3c8969e1 10c9c6a34d92ad86eafa8083ee5dcd449acb369d287c Unable to decode output 
address Unspent 0 239 2016-10-21 13:16:09 

https://blockchain.info/tx/6ecf2b6d21 31 2584c51 550534729589c1 95a4fe5970688384b3ea76477fd9afe Unable to decode output 
address Unspent 0 297 2016-10-21 13:16:09 

https://blockchain.info/tx/a071 1aad3475b773f408779aa5aecc523e2c213cecb0f7a93d7d46ff1 cl 36e1 8 Unable to decode output 
address Unspent 0 296 2016-10-21 13:16:09 

https://blockchain.info/tx/59d41 ca2325c74439a84c2a7eb46033fe21 331 5e9e1 87c1 6dc6a8cb702adffaf Unable to decode output 
address Unspent 0 296 2016-10-21 13:16:09 

https://blockchain.info/tx/18f6ae5323aff1 dca6cf4fc41 57fff5a990b37f0e3e43f762e9df5cadce08982 Unable to decode output address 
Unspent 0 296 201 6-1 0-21 13:16:09 

https://blockchain.info/tx/884736546d806654781f4d145b87e9e947aaf0f76d28e3c4fa399fe2d89a5c43 Unable to decode output 
address Unspent 0 264 2016-10-21 13:16:09 
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(74.61 KB 1068x671 screen. png ) 



Anonymous 1 2/08/201 6 (Thu) 1 8:40:46 IPreviewl No, 29 [X] del »30 

https://blockchain. info/address/1 L8WoLiiGiNvi3TXXW4nMZMwLpKZeV3qKf 
https://blockchain.info/tx-index/185992996 
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»29 

https://blockchain.info/tx/74f9fcb4e1 d047278d46cbbba81 331 abcb2628ea9e250c9a960c002538c664d9 
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NEW CODE: 

https://qithub.com/WikiLeaksFreedomForce 
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FILE ASSEMBLY CODE: 

http://aatewav.alop.me/ipfs/QmVWJVbis7es6s7cDsRmt5WBHeioc4HztR4R74Lg8KBmhU/e091 1 .php 
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(21 .25 KB 435205block.zip) 



http://aatewav.alop.me/ipfs/QmQniYcDmRMoNCSkaNiwLaBZMFFT3vX8GmF25S9TdJfpRT/435205block.zip 


Anonymous 1 2/08/201 6 (Thu) 20:04:21 [Previewl No. 34 [XI del 
https://blockchain.info/address/135zDahbNcmPk3abveJmH75viLdVZechsK?offset=13350&filter=4 
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https://blockchain. info/address/1 E14k7i1 wVSvtoMfbaCnbmhofVMNsZrpLh 
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(84.26 KB 1062x671 new.pnq) 



https://blockchain.info/tx/624075b5d5d56b619b41 3966297b441 ae727fc01 9871 c22676405dd5d8200cc9 

View information about a bitcoin transaction 624075b5d5d56b619b413966297b441ae727fc019871c22676405dd5d8200cc9 

>OMG 

>1 thnk I found it 
>hang on 
>look at this 

https://blockchain.info/block/0000000000000000026fb408f6a035e55c126a1409e9c5f5fea7d22610645289 
>Transactions contained within bitcoin block 435172 
>scroll down to roughly 

>lt's possible that a 7z or other compressed text document with instructions is hidden within a single transaction 
>And that transaction is spent. 

>37 7a be af 27 1c 20 04 Oe 15 c8 Of 26 20 20 20 20 20 20 20 62 20 20 20 20 20 20 20 50 c7 af >be 01 20 21 67 73 63 6c 69 6c 69 70 

74 72 68 6e 65 74 65 65 74 73 67 68 69 6e 61 65 75 6f 64 >69 6e 65 72 72 69 69 20 01 04 06 20 01 09 26 20 07 0b 01 20 01 21 21 01 

20 Oc 22 20 08 Od Oa >01 86 66 4f f7 20 20 05 01 19 Oc 20 20 20 20 20 20 20 20 20 20 20 20 1 1 17 20 77 20 6c 20 63 >20 6f 20 64 20 

65 20 2e 20 74 20 78 20 74 20 20 20 19 04 20 20 20 20 14 Od Oa 01 20 bd 31 89 >c3 e9 42 d2 01 15 06 01 20 20 20 20 20 

>That's a possible 7z encrypted message, albeit a small one 

https://blockchain. info/address/1 E14k7i1 wVSvtoMfbaCnbmhofVMNsZrpLh 

Transactions sent and received from bitcoin address 1 E14k7i1 wVSytoMfbaCnbmhofVMNsZrpLh. 

https://blockchain.info/tx/4aadbaa0edd0f0b19d5e8ae0a818e3ac7fde7cd5f6caedcd9cf4e7ac2b9582e9 

View information about a bitcoin transaction 4aadbaa0edd0f0b19d5e8ae0a818e3ac7fde7cd5f6caedcd9cf4e7ac2b9582e9 
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1Gii1VoJksAKrL34Gd4sLF1bUTQdUq1qe1 and i dont know if this is old news but this should be JA's address.. There's a DMS at the 
beginning of the txs 

First being oldest. 1Fpdrx7Q7fVgf19imhXeDwNEhBAQV1a6Gp 

for example this is one of the 4 txs.. its cryptic so "im dead when back" and likely implies something to do with the hex 

If you look at the oldest tx on Gii, you'll see what looks like a dms.. Y is for key. It's always been here but it needs to be disarmed. Thats 
basically what it is. 

The account basically returns what is sent to it., which is what this ’QdUql qel 1 

The unconfirmed tx has actually been there since this weekend since I found it but it looks like it rejected it and has one from 12/6 
http://qatewav.qlop.me/ipfs/QmXUMi6fRG9mNHLTqvthyqDJxUodGCnWFkBfcQfaqZo896/outtx.xlsx 

list of unable to decode from block 435251 
435251 .xlsx 

list of unable to decode from block 435252 
435252. xlsx 

http://qatewav.qlop.me/ipfs/QmTtdJr3sEYeWSHdqWTvP7uq89YRQWvUKbvWYcbeBKY6kh/435251 .xlsx 
http://qateway.qlop.me/ipfs/QmUs1xK7wf89qf9t4wtdRNPpVdaQqnsmLDBcuBrbFcQT5v/435252.xlsx 

http://qatewav.qlop.me/ipfs/QmUttF4q2JqizGqKkuJoXvWvUaVZvG47XKAquHDYRX1NXP/block 435250 unable to decode.xlsx 


There's only one that had any actual value associated (it's on the list ending in 51) all other transactions have shown as 0 
an example would be if you find a hex code for a 7zip header 

such as in https://blockchain.info/tx/5c593b7b71063a01f4128c98e36fb407b00a87454e67b39ad5f8820ebc1b2ad5 

View information about a bitcoin transaction 5c593b7b71063a01f4128c98e36fb407b00a87454e67b39ad5f8820ebc1b2ad5 

at bottom 377ABCAF271C 

that is the hex code for a 7zip header 

also i believe this has footer http://www.7-zip.org/recover.html 

just to make sure im not wasting my time, is it a waste of time to be looking 

at https://blockchain.info/address/135zDqhbNcmPk3qbveJmH75yiLdVZechsK?offset=10800&filter=4, batches of transactions -20 
each(sometimes significantly more such as the 57 on the 21 ) at same time, literally thousands of transactions in a row with same file 
size 

throuugh 300 some odd pages, other than the first few, there are only 3 file sizes 
and average bitcoin transaction is -.001 over 84444 transactions 

this one is huge... 

https://blockchain.info/tx/842a17b3a797ec03c7ab856a6e62103c3288e03d790c8dc00a6e9175d164ece0 

https://blockchain.info/address/135zDohbNcmPk3qbveJmH75viLdVZechsK?offset=15250&filter=4 
Transactions sent and received from bitcoin address 135zDqhbNcmPk3gbyeJmH75yiLdVZechsK. 
same size transactions but changes size on oct 9 
fucktons of transactions for weeks all of which are same size 

https://blockchain.info/ip-address/47.89.39.165. a lot of same size same time transactions and unable to decode output 

http://qatewav.olop.me/ipfs/Qmaut7iGTaCoVZE4RAuV6cNBY5B2HxYoZDpaFrpKYKqYoH/Filenames 16D.txt 
http://qatewav.olop.me/ipfs/QmUUWrmeCQrhVQrbVBJqKKBbEWoHEpqWPoKhKi6Yune52Q/Filenames 16G.txt 
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7b03d286ecb41 0884a5e07e41 b6a7be1 509afa99e4e001 003f71 bb31 9dfe84dd 

e0f3a7f25bfb941 5a1 1 6f26d7f71 87821 57c3772f0e67acc00af2b8aa4309fb7 
603c1 28766c751 60b533f4f6cfbf 1 568c9ae7cb238a20791 da7437c60afd81 4b 
20aaf28f5030dcb5bcfe9d1 d2ed632d21 3671 ebef78587e3a629c7a3bdf0d93b 
a2feacf 1 a3e2d1 e2852326b26e67a22cb784a7c0d6f1 d9921 3ee1 2b3891 8821 8 
6e2bead2e61 fd87f23e75ad29389f4e58db92b7a96c04e81 f51 33f29e50f52ac 
d51 5d0eae9ea00fe1 6b9335ab946339d6eeef00c7f77c44c2ef41 fab738f4401 
da43c8be1c81 ef20c9301 4341 f7dcb744fff0388fcf6d21 4a84be4895fa2270b 
this wallet 

https://blockchain. info/address/1 AfdbCzDrRrMEqAXkF8kxVRCkPzB8HxoHD?offset=400&filter=1 
wtf? 

must be either a wallet no one cares about or a bug like the wallet with the ripemd hash 00000000000000000000000 
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»37 

https://blockchain. info/address/1 Giil VoJksAKrL34Gd4sLF1 bUTQdUqlqel 
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Possible tip: 

https://blockchain.info/tx/7f1 e4e76084ab2a44b484358900d74261 e4629879db1 73b85251 cb54cac21 070 
https://blockchain. info/address/1 NAQExkFZTFJKQq76KoyUosoQEfiY8K9GN 
https://blockchain.info/address/1B896LaaMVJvQD84ko52XN3976aaKA7nXJ 

Multiple 'Escrows'. Seems like addresses are using the change as in cablegate.7z. 
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»40 

From: 

71 41 f6c62892c4c3b85aa989ba54b27be274f5200a7 1 5439a75d44b3331 da30f 
1 883ec71 f568cb0644606d2fbfd57e9b01 d008503f90b6d934b56d548c08f33d 
C9924669d668e2bcc6c64038f6a33c984cff3d8be75885291 1 f841 4666034046 
56f5a921 d6fe99071 5fef88b56379ba271 6aa80ec02f431 0fa47e2e68ae700e4 
eb540314f01 a8f79301 b3b2fdd2f3dbf1 62f343b38b91 3cd860aae21 a2a63f34 
fl 9c51e46adb68e9235637d7b68d59e0bff6bc8cc01 03c4421 4efcfe9aa1 40af 
8e3b1e5d7a290d78b0e34fd54c97da3274c3d5a1 549ff 1 228bdb63551 fbl 1 dc6 
5501 f5a1 930640ee9e554a254d8df29a1 4b5f5fbc97c31 aa0232f9a7202976c9 
3 1 9ffa2 1 5f446d5009 1 d6900c2843 1 9d3d95a0c2 1 ff0ec5b77cf0c08ffc22d52 
718c3be4557660259e38e041a04f7703e8ade3803ab79eda3bc700aeeca96628 
bad344983f7bfa0f84f2befae1 el 78c55b90dbecb1 aadc074643e1 59e34054f1 
5fb72ef284c4bf1 31 ffa57ba957d03e28e4e9e0ce53ceb6a97e84bab3d1 1 fcl d 
60d5d25c4c55a032e3842770495d72ff2f4f7c81 1 a522a1 8e51 b49e1 921 32283 
7bafcd844fc308280828d2685ab506bd88310653fe7cf43d380cb21a333bf9d1 
69ac8f52cdad01aa7f5d97ff8903a536e52d43026dfac98dabb1ffac9343808b 
421 8dacb23d2a9a09843e1 1 el fOcI c467ff0640c381 c3022b34309d847c73584 



all from 435165-435382 (some are missing because API limits), spent < 33%, avg unspent value < 0.001 btc, at least 4 outputs 
https://codepaste.net/ta5hyb 
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(2.45 MB txs.txt) 




spent < 51%, avg unspent value < Ibtc, at least 2 outputs 
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does anyone have a backup of the endchan thread with the posts of the 7z footer and the screenshot of the deleted files from 
wikileaks.org? 
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https://archive.fo/46rS9 
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Discord #blockchain log bot for past two days 
https ://blarqbot.xyz/loqs/#3cvppr 
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(165.70 KB 960x540 Screenshot 20161208-223040.pno) 
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That last one is one of the missing posts from here I think. Headers/footers. Run off local. Please share the pictures above after 
confirming for yourselves. 
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https://github.com/manlv/BlockChainParser 
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https://rn.box.com/shared item/https%3A%2F%2Fapp.box.com%2Fs%2Fkiaa2ri8iat70i87av0sv3wg3i1zcro7 
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We are working hard. Come check in at discord. Let's get this done. The more people on this, the more impossible will be to stop. Let's 
not let Jean be forgotten. https://discord.gg/3eV4N 


Possible dms wallet? Anonymous 1 2/09/201 6 (Fri) 1 6:06:40 [Previewl No. 53 [X] del 
1 Giil VoJksAKrL34Gd4sLF1 bUTQdUql qel 

Have not linked to JA/wl personally, could someone take a look at this thing?? Definitely something weird here 
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(1 0.97 KB 540x1 07 IMG 20161209 080758.ipol 

| IGl i 1 VoJksAKrL34Gd4sLf 1 bUTQdUqlqel| 



1Gii1VoJksAKrL34Gd4sLF1bUTQdUq1qe1 reposting screen shot.... The first post is glitching the last seven characters on my end? 
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»48 

»45 

the last post was a screenshot of wikileaks.org showing how some files were deleted 
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sample .FLI videos, this format is commonly used for maps like 

this https://woodshole.er.usqs.qov/operations/modelinq/circulation.html they come out of cad software like autodesk 

http://qatewav.olop.me/ipfs/QmTUI-lqamFvoUwesutXosfGprHYMn2vwX6MGp3rvYKDxDiQ/2ARMS.FLI 

http://qatewav.qlop.me/ipfs/QmTvBvE3pVGpnsq2eayY1 kmxHfquXD jxC5nZfvxz3hWyL4/APACHE. FLI 

http://qatewav.qlop.me/ipfs/QmV2ihMzqdr3S35YCrukhhAC1KnKKQ36UYGSXM7Zs9H9J2/BUGS.FLI 

http://qateway.qlop.me/ipfs/QmdxiHSGTZkuvi6qaPmXWDDLCixbqbEiY5ZZbamBRUQ8DT/MANTA.FLI 

http://qatewav.qlop.me/ipfs/Qmd8oTT3YsYRswxWxAfaGWdZNyxG1pcEAKMe8fCLaNa8JK/MSH.FLI 
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HOW TO SPLIT AND UPLOAD GIANT FILES: 

1 . Take giant file and slip it into pieces with 7zip 

Linux: http://superuser.com/questions/184557/how-to-create-multipart-7zip-file-in-linux 
Example: 

7z -vl 00m a my_zip.7z my_folder/ 

Windows: http://www.linqlom.com/it-support/how-to-split-a-larqe-file-usinq-7-zip/ 

2. Upload the pieces to mega.nz or filedropper (max 5GB): 
filedropper.com 

mega.nz 

2b (optional). Do it from the command line to save time: 
https://meqatools.meqous.com/ 

Example: 

https://youtube.com/watch?v=LWfFMysaspQ [Embed1 &feature=voutu.be 

FILES WE NEED UPLOADS FOR: 

1 . All insurance files 

2. Blockchain 

3. SQL databases of the blockchain 

4. wikileaks.org 
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jOdumpprivkey <31 qneokFGwpEkoZRksjymxZAiTEmAim3Ab> 
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If the internet goes down soon: 

https://www.qeckoandflv.com/22562/chat-without-internet-connection-mesh-network/ 



http://www.cnn.com/201 4/1 0/1 6/tech/mobile/tomorrow-transformed-firechat/ 
http://hyperboria.net/ 
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(120.13 KB 540x960 end.pna) 
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(271 .06 KB 1 280x1 024 endend.pnq) 



»60 

»55 

»49 

»48 

»45 

»44 
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(30.92 MB EndChanPOL Thread.zip) 
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thanx 


r 
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podesta emails file was gone and up again some time later 
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(821 .28 KB 1 83x255 wew.gif) 



' ‘s/ortyrioN ^sprint- 

THIS EXTREMELY PARE Ft PE MAS ONLY 
1 KNOWN COPY DUPLICATION BY SAVING AND 
DISTRIBUTING IS STRICTLY PROHIBITED AND 
PUNISHABLE BY UP TO JS YEARS IN fEOCPAL 
PRISON WITH A FINE UP TO SIO.OOO.OOO. 


PROTIP: 

Download first insurance file: https://web.archive.org/web/20100901 162556/https ://leakmirror.wikileaks.orq/file/straw-qlass-and- 
bottle/insurance.aes256 

Write a python script that tries words from a dictionary on it and writes down the ones that don't have errors (example ONION), (make 
sure to try with different both lower and upper case) 

Read words that don't produce errors. 
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»63 

did you diff them after? might want to... 
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https://i. imgur.com/nTYDpPb. png 
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most are not verified 

headers: 

doc DOCF 11 E0A1 B1 1AE1 

xls DO CF 11 EO A1 B1 1A El 

ppt DOCF 11 E0A1 B1 1 A El 

zip 50 4B 03 04 1 4 (I think this one is wrong) 

jpg FF D8 FF EO 00 1 0 4A 46 49 46 00 01 01 

gif 47 49 46 38 39 61 4E 01 53 00 C4 

pdf 25 50 44 46 2D 31 2E (I think this one is wrong too) 

7zip 37 7A BC AF 27 1C (verified at endchan) 

Torrent 64 38 3A 61 6E 6E 6F 75 6E 63 65 
AVI 52 49 46 46 

footers: 

doc 57 6F 72 64 2E 44 6F 63 75 6D 65 6E 74 2E 

xls FE FF FF FF 00 00 00 00 00 00 00 00 57 00 6F 00 72 00 6B 00 62 00 6F 00 6F 00 6B 00 

ppt 50 00 6F 00 77 00 65 00 72 00 50 00 6F 00 69 00 6E 00 74 00 20 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 

zip 50 4B 05 06 00 (probably wrong) 

gif 21 00 00 3B 00 

pdf 25 25 45 4F 46 (probably wrong) 

7zip 00 00 00 17 06 (verified with cablegate) 

we are waiting for someone to post the headers and footers for all pgp, gpg files, they can be found by searching for common hex 
blocks in different files of the same type, someone finished this list but has not posted it. hopefully it's up today. 


Anonymous 1 2/1 0/201 6 (Sat) 04:51 :03 [Preview] No. 69 [X] del 
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I used a batch with GPG on bash for an 8192 key 

Key-Type: RSA 
Key-Length: 8192 
Name-Real: Name 
Name-Email: name@email.com 
Expire-Date: 1 0y 

Preferences: SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES TWOFISH CAST5 BZIP2 ZLIB ZIP Uncompressed 
That let me create an 81 92 key. 
and Thanks for the input! 


PGP 2048 PUBLIC KEY HEADER 
mQENBFhLe 



PGP 4096 PUBLIC KEY HEADER 
mQINBFhLe 

PGP 2048 KEY PAIR HEADER 

.XK (with this there was suble variety before the string to the left, either >, 1/2, or 3/4 before the for example, these are the strings in 
three test files: 

1: rVz.X Kz 
2: • >.XK{ 

3: *.%.XK| 

PGP 4096 KEY PAIR HEADER 

•>.XKz (this was consistent across 2 test files) 

PGP 4096 PRIVATE(SECRET) KEY HEADER 
•>.XKz 

PGP 2048 PRIVATE KEY HEADER 

similar results to the key pair, three files. 2048 may have something different going on than 4096. 

1: rVz.XK 
2: • >.XK 
3: *.%.XK 

PGP 4096 PRIVATE KEY HEADER 
• >.XKz 

8192 isn't supported by kleo generation so i'm lookin for a way to do that, if someone else can chip in i'd apprecaite it. 

Hope this helps. 


Yes, outside the BEGIN PUBLIC/PRIVATE KEY part. You don't need to convert it to hex I can do that but it would help doccumenting it 
like the previous magic numbers posted. 2048, 4096, and 8192 keys are what I want to search for. 


I presume you mean outside of the BEGIN PUBLIC PGP KEY etc. strings right? 
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There news that some groups are starting to find torrent headers in the blockchain. Some advice regarding that. 

1 . Check the file structure. 

A torrent file is a bencoded dictionary with the following keys: 
announce — the URL of the tracker 

info — this maps to a dictionary whose keys are dependent on whether one or more files are being shared: 

name — suggested filename where the file is to be saved (if one file)/suggested directory name where the files are to be saved (if 

multiple files) 

piece length — number of bytes per piece. This is commonly 28 KiB = 256 KiB = 262,144 B. 

pieces — a hash list, i.e., a concatenation of each piece's SHA-1 hash. As SHA-1 returns a 160-bit hash, pieces will be a string whose 
length is a multiple of 160-bits. If the torrent contains multiple files, the pieces are formed by concatenating the files in the order they 
appear in the files dictionary (i.e. all pieces in the torrent are the full piece length except for the last piece, which may be shorter), 
length — size of the file in bytes (only when one file is being shared) 

files — a list of dictionaries each corresponding to a file (only when multiple files are being shared). Each dictionary has the following 
keys: 

path — a list of strings corresponding to subdirectory names, the last of which is the actual file name 
length — size of the file in bytes. 

2. Check the tracker information. 

Multiple trackers 

BEP-0012[4] extends BitTorrent to support multiple trackers. 

A new key, announce-list, is placed in the top-most dictionary (i.e. with announce and info) 

{ 



'announce-list': [['ctrackerl -url>’]['<tracker2-url>']] 

} 

3. If it a single file or Multi file torrent 
Single file[edit] 

Here is what a de-bencoded torrent file (with piece length 256 KiB = 262144 bytes) for a file debian-503-amd64-CD-1 .iso (whose size is 
678 301 696 bytes) might look like: 

{ 

'announce': ' http://bttracker.debian.orq:6969/announce‘, 

'info': 

{ 

'name': 'debian-503-amd64-CD-1 .iso’, 

'piece length’: 262144, 

'length': 678301696, 

'pieces': '841 ae846bc5b6d7bd6e9aa3dd9e551 559c82abc1 ...dl 4f1 631 d776008f83772ee1 70c4241 1 61 81 90a4' 

} 

} 

{ 

'announce': ' http://tracker.site1. com/announce 1 , 

'info': 

{ 

'name': 'directoryName', 

'piece length': 262144, 

'files': 

[ 

{'path': ['1 1 1 .txt'], 'length': 111}, 

{'path': ['222.txt'], 'length': 222} 

i 

'pieces': '6a8af7eda90ba9f851831073c48ea6b7b7e9feeb...8a43d9d965a47f75488d3fb47d2c586337a20b9f 

} 

} 

4. Trackers 

You can see the tracker in: 

'announce': ' http://bttracker.debian.org :6969/announce‘, 

5. Check the trackers to see if the files are valid. 

Trackers themselves should be verified by Verisgn or any other tool for tracker verification. 

If the file is downloaded, keep it and post it here. If the torrent was incomplete or corrupted it might be possible to fix it with file recovery 
software. 
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HELLO 



- file header match (type: jpg) (block hash: 000000000000000001 C49996dd0946a3eb734173fd2b0c66c84de64e96f835a5) (tx hash: 
4b0cd7e1 91 efOal 4a9b6ab1 c5900be5341 1 8c20a332ff264076481 68d2722a2e) 
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(2.34 MB 720x8252 guide. png) 


I 


will be handy soon 
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list used on the git code 

if "D0CF1 1 E0A1 B1 1 AE1”.lower() in hexcode: 
filetype += "DOC Header Found " # DOC Header 
if "576F72642E446F63756D656E742E".lower() in hexcode: 
filetype += "DOC Footer Found " # DOC Footer 
if "D0CF1 1 E0A1 B1 1 AE1 ",lower() in hexcode: 
filetype += "XLS Header Found " # XLS Header 

if "FEFFFFFF000000000000000057006F0072006B0062006F006F006B00".lower() in hexcode: 




filetype += "XLS Footer Found " # XLS Footer 

if "D0CF1 1 E0A1 B1 1 AE1".lower() in hexcode: 

filetype += "PPT Pleader Found " # PPT Header 

if "A0461 DF0".lower() in hexcode: 

filetype += "PPT Footer Found " # PPT Footer 

if "504B030414".lower() in hexcode: 

filetype += "ZIP Header Found " # ZIP Header 

if "504B050600".lower() in hexcode: 

filetype += "ZIP Footer Found " # ZIP Footer 

if "504B03041 40001 00630000000000". lower() in hexcode: 

filetype += "ZIPLock Footer Found " # ZLocked Encrypted 

if "FFD8FFE0001 04A4649460001 01 ".lower() in hexcode: 

filetype += "JPG Header Found " # JPG Header 

if "474946383961 ”Jower() in hexcode: 

filetype += "GIF Header Found " # GIF Header 

if "474946383761 ”Jower() in hexcode: 

filetype += "GIF Header Found " # GIF Header 

if "2100003B00"Jower() in hexcode: 

filetype += "GIF Footer Found " # GIF Footer 

if "25504446" Jower() in hexcode: 

filetype += "PDF Header Found " # PDF Header 

if "2623323035”. lower() in hexcode: 

filetype += "PDF Header Found " # PDF Header 

if "2525454F46".lower() in hexcode: 

filetype += "PDF Footer Found " # PDF Footer 

if "61 6E6E6F756E6365".lower() in hexcode: 

filetype += "Torrent Header Found " # Torrent Header 

if "1 F8B".lower() in hexcode: 

filetype += ".TAFt.GZ Header Found " # TAR/GZ Header | Going to have lots of false positives 

if "001 1AF".lower() in hexcode: 

filetype += "FLI Header Found " # FLI Header 

if "504B03040A000200".lower() in hexcode: 

filetype += "EPUB Header Found " # EPUB Header 

if "89504E470D0A1 A0A".lower() in hexcode: 

filetype += "PNG Header Found " # PNG Header 

if "6D51 51 4E42”.lower() in hexcode: 

filetype += "8192PGP Header Found " # 8192 Header 

if "6D51 494E4246672F".lower() in hexcode: 

filetype += "4096PGP Header Found " # 4096 Header 

if "952e3e2e584b7a". lower in hexcode: 

filetype += "2048PGP Header Found " # 2048 Header 

if "5261 7221 1A0700".lower() in hexcode: 

filetype += "Secret Header Found" # Secret Header 

if "6D51 454E424667".lower() in hexcode: 

filetype += "RAR Header Found" # RAR Header 

if "EFEDFACE".lower() in hexcode: 

filetype += "UTF8 Header Found" # UTF8 header 

if "4F676753".lower() in hexcode: 

filetype += "OGG Header Found" # OGG Header 

if "42494646". lower() in hexcode and "5741 5645". lower() in hexcode: 

filetype += "WAV Header Found" # WAV Header 

if "42494646". lower() in hexcode and "41 564920". lowerQ in hexcode: 

filetype += "AVI Header Found" # AVI Header 

if "4D546864".lower() in hexcode: 

filetype += "MIDI Header Found" # MIDI Header 

if "377ABCAF271 C".lower() in hexcode: 

filetype += "7z Header Found" # 7z Header 

if "0000001 706". lower() in hexcode: 

filetype += "7z Footer Found" # 7z Footer 


r 
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Logless BM bunker 

http://aatewav.gloD.me/ipfs/QmSLGxufdzkNBMGaa1 NwUuaCrcethPavN3iPzNYFtSDEkK/ffbbd7d918a09e876a06820498ec9e0c.ipg 

Use the text in this image, generate its SHA256 hash value. 

Add Chan -> Create a new chan -> chan name: [hash] 
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https://zerobinqmdqd236y.onion.to/77cd87b53ca1 99bdb#+Ht0Kq+aa8Nqx4oKXQIPM9UZibcVuZMMBMw22lc/+pw= 

need to search each output script individually with trid that was sent TO the wikileaks address by some address, and in particular the 
time frame of 1 0/1 7 to 1 0/29 

his dead man's switch was "check in by the end of the day on friday" 

lowest number of transactions + highest fees + 0.0000000001 amounts paid (or close to 0 as possible because it is blackholed money 
since the data dictates the destination address and you don't have the priv key for the destination address) 

and yes output scripts less than 40 are significant as well, because they do not un-hash (so to speak) to a valid address 
also any output hex that is an ODD number is suspect 

you can hide small shit, like keys or a text document inside a zip file (really small 2kb footprint) 
the output script looks like this 

"OP_DUP OPJHASH160 9f2fe1c79fefbc6166a906fc4fdadc61a08709fa OP_EQUALVERIFY OP_CHECKSIG" 
if you take the hex string portion only: 

9f2fe1c79fefbc61 66a906fc4fdadc61 a08709fa 
and use it on this website: 
http://bitcoinvalued.com/tools.php 

put that string into the top right field, hit convert 

Result: BitCoin address: 1 FWhoQ3scrAPh7M7uy4jsk7VCNTe3vZeVL 

This 9f2fe1 string is the hashl 60 of wallet 1 FWhoQ3 

Example: Looking at a transaction 

"C234056fd6cc3bad6f51945e36893affc5493e824cfc3e90b51860a24f069a80" 
you'll see that part of the transaction was sent to the wallet named: 

"1 FWhoQ3scrAPh7M7uy4jsk7VCNTe3vZeVL” 

https://blockchain.info/tx/c234056fd6cc3bad6f51945e36893affc5493e824cfc3e90b51860a24f069a80 

what has happened here is that the wallet 1 FWhoQ3scrAPh7M7uy4jsk7VCNTe3vZeVL has received part of the UTXO (unspent 
transaction) from the sender 

this transaction ‘proves* that 

hell it was confirmed 20000 times or whatever 

"27401 Confirmations" 

so now the 1 FWhoQ wallet may spend what they received - they are now able to spend it without throwing red flags 

1 FWhoQ has to put the right shit in the input scripts (bunch of version and shit and that's the input script and is basically automated by 
the wallet and cannot fuck up because it has to have the wallet's key to be able to spend the transaction out of the wallet) 

and also 1 FWhoQ will put the recipient's FIASH1 60 into the output scripts 

there will be one output script per recipient address 

so if i wanted to send a file to the blockchain, i would have to send it to the addresses that my data dictates, because the data is in a 



particular order that creates the original file. 


so if the first 20 bytes were ABCDABCDABCDABCDABCDABCD then it would send to this address: BitCoin address: 

1 NDUKKcNpLnAwcozASKSal 1 

and that is because INDUKK's hash160 value is ABCDABCDABCDABCDABCDABCD 

if I don't own 1 NDUKKcNpLnAwcozASKSal 1 , then I'm basically throwing money away because i can't send it out from the 1 NDUKK 
wallet because i don't own that wallet because i don't have the private key and that is the most major part of the input script that allows 
the confirmations to occur(edited) 

therefore the amount I send will be very, very small, but i may allow a big transaction fee (as a bounty) to make sure that transaction is 
confirmed and included in the blockchain quickly 

and the way bitcoin works, when I send it, I have to send from only sources of unspent transactions. If I wanted to give you 1 BTC and I 
had 1 0BTC, but I didn't have any unspent transaction in my wallet that was exactly 1 BTC, then I'd have to send you chunks (for 
example 0.3 and 0.25 and 0.21 and 0.24) or i'd send you an amount larger than what i'm trying to send you if my smallest unspent 
transaction was one that i had received that was 2BTC. So my 1 0BTC wallet might be filled with four transactions -> 2BTC + 5BTC + 
0.5BTC + 2.5BTC 

and if i had to send you 2BTC, I'd want my 1 BTC in change, so i have to include that as a recipient, i can choose to have it come back 
to my own wallet (if my wallet software allows and handles that properly) or i could give it another wallet that my wallet software auto 
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need to search each output script individually with trid that was sent TO the wikileaks address by some address, and in particular the 
time frame of 1 0/1 7 to 1 0/29 

his dead man's switch was "check in by the end of the day on friday" 

lowest number of transactions + highest fees + 0.0000000001 amounts paid (or close to 0 as possible because it is blackholed money 
since the data dictates the destination address and you don't have the priv key for the destination address) 

and yes output scripts less than 40 are significant as well, because they do not un-hash (so to speak) to a valid address 
also any output hex that is an ODD number is suspect 

you can hide small shit, like keys or a text document inside a zip file (really small 2kb footprint) 
the output script looks like this 

"OP_DUP OPJHASH160 9f2fe1c79fefbc6166a906fc4fdadc61a08709fa OP_EQUALVERIFY OP_CHECKSIG" 
if you take the hex string portion only: 

9f2fe1c79fefbc61 66a906fc4fdadc61 a08709fa 
and use it on this website: 
http://bitcoinvalued.com/tools.php 

put that string into the top right field, hit convert 

Result: BitCoin address: 1 FWhoQ3scrAPh7M7uy4jsk7VCNTe3vZeVL 

This 9f2fe1 string is the hash160 of wallet 1 FWhoQ3 

Example: Looking at a transaction 

"C234056fd6cc3bad6f51945e36893affc5493e824cfc3e90b51860a24f069a80" 
you'll see that part of the transaction was sent to the wallet named: 

"1 FWhoQ3scrAPh7M7uy4jsk7VCNTe3vZeVL” 

https://blockchain.info/tx/c234056fd6cc3bad6f51945e36893affc5493e824cfc3e90b51860a24f069a80 

what has happened here is that the wallet 1 FWhoQ3scrAPh7M7uy4jsk7VCNTe3vZeVL has received part of the UTXO (unspent 
transaction) from the sender 

this transaction ‘proves* that 

hell it was confirmed 20000 times or whatever 


"27401 Confirmations" 

so now the 1 FWhoQ wallet may spend what they received - they are now able to spend it without throwing red flags 

1 FWhoQ has to put the right shit in the input scripts (bunch of version and shit and that's the input script and is basically automated by 
the wallet and cannot fuck up because it has to have the wallet's key to be able to spend the transaction out of the wallet) 

and also 1 FWhoQ will put the recipient's FIASH1 60 into the output scripts 

there will be one output script per recipient address 

so if i wanted to send a file to the blockchain, i would have to send it to the addresses that my data dictates, because the data is in a 
particular order that creates the original file. 

so if the first 20 bytes were ABCDABCDABCDABCDABCDABCD then it would send to this address: BitCoin address: 

1 NDUKKcNpLnAwcozASKSal 1 

and that is because INDUKK’s hash160 value is ABCDABCDABCDABCDABCDABCD 

if I don’t own 1 NDUKKcNpLnAwcozASKSal 1 , then I’m basically throwing money away because i can’t send it out from the 1 NDUKK 
wallet because i don't own that wallet because i don't have the private key and that is the most major part of the input script that allows 
the confirmations to occur(edited) 

therefore the amount I send will be very, very small, but i may allow a big transaction fee (as a bounty) to make sure that transaction is 
confirmed and included in the blockchain quickly 

and the way bitcoin works, when I send it, I have to send from only sources of unspent transactions. If I wanted to give you 1 BTC and I 
had 10BTC, but I didn't have any unspent transaction in my wallet that was exactly 1 BTC, then I'd have to send you chunks (for 
example 0.3 and 0.25 and 0.21 and 0.24) or i'd send you an amount larger than what i'm trying to send you if my smallest unspent 
transaction was one that i had received that was 2BTC. So my 10BTC wallet might be filled with four transactions -> 2BTC + 5BTC + 
0.5BTC + 2.5BTC 

and if i had to send you 2BTC, I'd want my 1 BTC in change, so i have to include that as a recipient, i can choose to have it come back 
to my own wallet (if my wallet software allows and handles that properly) or i could give it another wallet that my wallet software 
automatically generated 

Transactions that have 91 1 in the value are significant because they are a 
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Just a note on something I thought was weird, could be totally unrelated: 

Ed Snowden has mentioned zcash several times. 

one article referencing it here: https://news.bitcoin.com/snowden-zcash-bitcoin-risks/ 


https://s6424n4x4bsmqs27.onion.to/POLAK/res/15.html 



